37 matches found
K000162184: Spring Kafka vulnerability CVE-2026-41727
Security Advisory Description Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted retrytopic-attempts header to supply an out-of-range attempt count and cause the retry topic...
be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +174 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=4.0.0-m2, <=4.0.5)
org.springframework.kafka:spring-kafka MAVEN version =4.0.0-m2, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...
org.springframework.integration:spring-integration-kafka (2.0.1.release) potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.0.3.release)
org.springframework.kafka:spring-kafka MAVEN version 1.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.integration:spring-integration-kafka 2.0.1.release Sour...
org.springframework.cloud.stream.app:aggregate-counter-sink-kafka-09 (1.2.0.release), org.springframework.cloud.stream.app:bridge-processor-kafka-09 (1.2.0.release) +55 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.0.5.release)
org.springframework.kafka:spring-kafka MAVEN version 1.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.cloud.stream.app:aggregate-counter-sink-kafka-09...
org.springframework.cloud.stream.app:aggregate-counter-sink-kafka-10 (1.2.0.release), org.springframework.cloud.stream.app:bridge-processor-kafka-10 (1.2.0.release) +54 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.1.3.release)
org.springframework.kafka:spring-kafka MAVEN version 1.1.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.cloud.stream.app:aggregate-counter-sink-kafka-10...
com.blibli.oss:kafka-plugin (>=0.0.1, <=2.1.0), com.github.cirola2000:idol-metadata (0.0.1) +65 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.1.7.release)
org.springframework.kafka:spring-kafka MAVEN version 1.1.7.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - com.blibli.oss:kafka-plugin =0.0.1, =0.0.5, =1.3.0.release, =1.3.0.release,...
de.otto.eventsourcing:es-core (0.0.1), de.otto.eventsourcing:es-testsupport (0.0.1) potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.2.1.release)
org.springframework.kafka:spring-kafka MAVEN version 1.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - de.otto.eventsourcing:es-core 0.0.1 - de.otto.eventsourcing:es-testsupport...
io.kermoss:reactive-business-flow (0.0.1.release) potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.3.8.release)
org.springframework.kafka:spring-kafka MAVEN version 1.3.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - io.kermoss:reactive-business-flow 0.0.1.release Source cves: CVE-2026-41727...
org.springframework.integration:spring-integration-kafka (2.3.1.release) potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (1.3.10.release)
org.springframework.kafka:spring-kafka MAVEN version 1.3.10.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.kafka:spring-kafka and may be impacted: - org.springframework.integration:spring-integration-kafka 2.3.1.release...
ca.bc.gov.tno:service (>=0.0.1-alpha, <=0.0.6-alpha), cc.vihackerframework:vihacker-kafka-starter (>=1.0.4.r, <=1.0.6.r) +743 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=2.0.0.release, <=2.8.11)
org.springframework.kafka:spring-kafka MAVEN version =2.0.0.release, =0.0.1-alpha, =1.0.4.r, =3.0.0.release, =3.0.0.release, =1.0.1, =0.0.1, =1.0.1, =0.0.2, =1.0.0, =2.7.7.5, =2.7.0.beta1, =1.1.0, =1.3.0 and more Source cves: CVE-2026-41727 Source advisory: OSV:GHSA-53W6-V7CV-FC9H...
ai.telosforge:kimaira-starter-agentic (>=1.2.4, <=1.2.6), ai.telosforge:kimaira-starter-agentic-factory (>=1.2.4, <=1.2.6) +407 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=3.3.0, <=3.3.15)
org.springframework.kafka:spring-kafka MAVEN version =3.3.0, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =0.1.0, =0.1.0, =0.1.0, =1.0.0, =2.2.1, =8.15.0, =8.15.0, =8.15.0, =8.4.0, =11.11.0 and more Source cves: CVE-2026-41727 Source advisory: GHSA-53W6-V7CV-FC9H...
be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +172 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=4.0.0, <=4.0.5)
org.springframework.kafka:spring-kafka MAVEN version =4.0.0, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...
ai.langsa:ccaas-starter (>=cloud-0.1, <=0.6), ai.langsa:pom-ccaas-langsa (0.1) +266 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=3.2.0, <=3.2.10)
org.springframework.kafka:spring-kafka MAVEN version =3.2.0, =cloud-0.1, =1.0.10, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =3.3.0.0, =0.0.49, =1.0.7, =1.0.4, =1.0.4, =1.0.4, =1.0.5 and more Source cves: CVE-2026-41727 Source advisory: GHSA-53W6-V7CV-FC9H...
be.appify.prefab:prefab-annotation-processor (>=0.2.0, <=0.10.9), be.appify.prefab:prefab-core (0.2.0) +172 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=4.0.0, <=4.0.5)
org.springframework.kafka:spring-kafka MAVEN version =4.0.0, =0.2.0, =0.2.0, =7.0.0-alpha-springboot4, =7.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =14.0.0-alpha-springboot4, =12.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =2.0.0-alpha-springboot4,...
CVE-2026-41727
Summary: Spring for Apache Kafka’s retry topic infrastructure does not adequately validate user-controlled header values, allowing a crafted retry_topic-attempts header to supply an out-of-range attempt count and cause the retry topic router to misidentify a message’s position in the retry sequen...
cn.aradin:aradin-spring-actuator-starter (>=1.0.1, <=1.0.3), cn.caijava:caijava-all (>=1.0.1, <=1.0.3) +430 more potentially affected by CVE-2026-41727 via org.springframework.kafka:spring-kafka (>=2.8.0, <=2.8.11)
org.springframework.kafka:spring-kafka MAVEN version =2.8.0, =1.0.1, =1.0.1, =0.0.2, =2.7.7.5, =2.7.0.beta1, =1.1.0, =1.0.3, =1.0.3, =3.16.2, =0.0.1, =0.0.1, =0.0.8 and more Source cves: CVE-2026-41727 Source advisory: MEND:CVE-2026-41727...
CVE-2025-41727
creationtimestamp| type| source ---|---|--- 2026-01-27 11:38:25+00:00| seen| https://infosec.exchange/users/certvde/statuses/115966863286149942 2026-01-27 12:45:56+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdfs2mbefk2o 2026-01-27 12:46:26+00:00| seen|...
CVE-2025-41727 Beckhoff: Performing privileged operations and gaining administrator access
A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access...
CVE-2025-41727 Beckhoff: Performing privileged operations and gaining administrator access
A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access...
